如何通過存儲過程的參數爲EXECUTE語句

Question

CREATE OR REPLACE FUNCTION "Test"(character varying[],character varying[]) 
RETURNS refcursor AS 
$BODY$ 
DECLARE 
curr refcursor; 
filter text; 
counter integer; 
BEGIN 
    counter = 1; 
    filter = ''; 

    IF array_length($1,1) > 0 THEN 
     filter = 'AND '; 

     WHILE ($1[counter] <> '') LOOP 
       filter = filter||'LOWER('||$1[counter]||'::character varying) LIKE ''%''||LOWER($2['||counter||'])||''%'' AND '; 
       counter = counter + 1; 
     END LOOP; 

     filter = substring(filter FROM 1 FOR (char_length(filter)-4)); 

     OPEN curr FOR 
     EXECUTE 'SELECT "Reservation".* FROM "Reservation" WHERE "Reservation"."id" > 0 '||filter; 
     return curr; 
    END IF; 
END 
$BODY$ 
LANGUAGE plpgsql VOLATILE 
COST 100; 

SELECT "Test"(ARRAY['"Reservation"."status"'],'{"waiting"}'); 
FETCH ALL IN "<unnamed portal 1>"; 

我試圖打印出查詢：

"SELECT "Reservation".* FROM "Reservation" WHERE "Reservation"."id" > 0 AND LOWER("Reservation"."status"::character varying) LIKE '%'||LOWER($2[1])||'%' " 

但是，當它執行它說，沒有參數$ 2所以我意識到它不能訪問該存儲過程的參數。

我不必擔心sql注入的第一個參數，因爲它是硬編碼的。但是第二個參數必須通過執行。我怎麼做？

Answer 1

我發現我可以使用「USING」語句將參數傳遞給EXECUTE。

下面是最終的工作代碼：

CREATE OR REPLACE FUNCTION "Test"(character varying[],character varying[]) 
RETURNS refcursor AS 
$BODY$ 
DECLARE 
curr refcursor; 
filter text; 
counter integer; 
BEGIN 
    counter = 1; 
    filter = ''; 

    IF array_length($1,1) > 0 THEN 
     filter = 'AND '; 

     WHILE ($1[counter] <> '') LOOP 
       filter = filter||'LOWER('||$1[counter]||'::character varying) LIKE ''%''||LOWER($1['||counter||'])||''%'' AND '; 
       counter = counter + 1; 
     END LOOP; 

     filter = substring(filter FROM 1 FOR (char_length(filter)-4)); 

     OPEN curr FOR 
     EXECUTE 'SELECT "Reservation".* FROM "Reservation" WHERE "Reservation"."id" > 0 '||filter USING $2; 
     return curr; 
    END IF; 
END 
$BODY$ 
LANGUAGE plpgsql VOLATILE 
COST 100; 

SELECT "Test"(ARRAY['"Reservation"."status"'],ARRAY['no-show']); 
FETCH ALL IN "<unnamed portal 1>"; 

請注意，我有$ 1如EXECUTE語句的價值，因爲它接受$ 2作爲其第一個參數。